Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache Fineract

22 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-64618

    Apache Fineract: SQL injection vulnerability in Search API

    Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v…

    Apache Software Foundation Apache Fineract
  • Critical 9.1
    CVE-2025-58130

    Apache Fineract: Server Key not masked

    Insufficiently Protected Credentials vulnerability in Apache Fineract. This issue affects Apache Fineract: through 1.11.0. The issue is fixed in version 1.12.1. Users are encouraged to upgrade to version 1.13.0, the latest release.

    Apache Software Foundation Apache Fineract
  • Critical 9.4
    CVE-2024-32838

    Apache Fineract: SQL injection vulnerabilities in offices API endpoint

    SQL Injection vulnerability in various API endpoints - offices, dashboards, etc. Apache Fineract versions 1.9 and before have a vulnerability that allows an authenticated attacker to inject malicious data into some of the REST API endpoints' query parameter. …

    Apache Software Foundation Apache Fineract
  • Critical 9.9
    CVE-2024-23538

    Apache Fineract: Under certain system configurations, the sqlSearch parameter was vulnerable to SQL injection attacks, potentially allowing attackers to manipulate database queries.

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Fineract.This issue affects Apache Fineract: <1.8.5. Users are recommended to upgrade to version 1.8.5 or 1.9.0, which fix the issue.

    Apache Software Foundation Apache Fineract